The security of computing networks is an increasingly important issue. With the growth of wide area networks (WANs), such as the Internet and the World Wide Web, people rely on computing networks to transfer and store an increasing amount of valuable information. This is also true of local area networks (LANs) used by companies, schools, organizations, and other enterprises. Typically, LANs are used by a bounded group of people in an organization to communicate and store electronic documents and information. LANs typically are coupled to or provide access to other local or wide area networks. Greater use and availability of computing networks produces a corresponding increase in the size and complexity of computing networks.
With the growth of networks and the importance of information available on the networks, there is also a need for better and more intelligent security. One approach to securing larger and more complex computer networks is to use a greater number and variety of security devices. Security devices can also be used more frequently to monitor the activity or status of the elements in a computing network in order to protect them from attack. Security devices exist in a variety of forms and can be used to monitor, protect, respond to, and evaluate elements in the network such as desktop computers, servers, and routers. These network elements are commonly referred to as hosts and the terms “element” and “host” are used interchangeably herein.
Existing approaches to monitoring the security of computing networks tend to focus on individual security modules. Typical security modules can be categorized as either monitoring modules, assessment modules, or response modules. Often, a module can perform more than one of these functions and security products generally contain elements that implement the functions of one or more security modules. A monitoring module is able to identify a current intrusion or attack, either on the network or on one or more computers making up that network. Examples of monitoring modules are a host-based intrusion detection module, a network-based intrusion detection module, and a virus detection module. An assessment module is able to identify and evaluate potentially exploitable weaknesses or security risks in the network or on one or more computers making up that network. Examples of assessment modules are host based modules which assess file access permissions or patch states, and scanners which identify vulnerabilities by attempting to exploit them across the network. A response module is able to address intrusions or security vulnerabilities that are identified by a monitoring or assessment module. Examples of response modules are auto-fix modules which correct vulnerabilities by changing permissions or applying patches, blocking modules which prevent attacks from reaching their targets and reporting modules which report intrusions or vulnerabilities for human attention. As computing networks have grown and the information they contain become more valuable and vulnerable to attack, network security has become increasingly complicated. The conventional solution to increasing security in complex computing networks is to simply add an increasing number and variety of security modules onto the network. These added security modules can be devices coupled to the network, software modules loaded onto hosts in the network, or a combination of both.
The problem with the conventional method is that it is essentially an ad hoc approach. As networks become more complex and as attackers become more adept at evading simple security measures, more security products are needed to protect the network. With each security device that is added to the network, additional security data is generated. A distributed computing network with multiple security devices quickly becomes unmanageable due to the amount of security data that must be analyzed and the security management decisions that need to be made. Most security systems need more than a single management system, and even those systems with one management system, produce a large volume of data with little ability to correlate and respond based on data from multiple modules.
Furthermore, the various security components that are added to the network do not automatically work together. This produces a situation where there is a large collection of low-level security data and little integration or intelligent use of this data. This large volume of low-level data overburdens computer security system administrators and often results in false-positive security alerts. These problems have been addressed to a limited extent through customized linking of disparate security devices. However, each security component must be customized in order to work with the other security devices in the network and to enable sharing of security data. This customization process is typically expensive and complicated. Some systems support the collection of data from a variety of sources, in some cases in a central database, and limited analysis of that data. But there remains an inability in the prior art to collect live data from multiple security modules, coordinate the analysis of that data, and trigger subsequent near real time security responses that are meaningful.
In view of the foregoing, there is a need in the art for a system and method for managing the security of a complex distributed computing network. Specifically, there is a need to couple disparate security modules to a single interface that allows the security modules to communicate. An integrated system capable of coordinating security data from a variety of sources will have a better context in which to consider security events and make sound decisions.
There is a further need to support an integrated system that allows security modules to send and receive messages and to communicate with logic components that allow the security modules to work together. A network security system can provide a significantly improved security posture when disparate data can be assimilated and acted upon in near real time. Because of the very large volume of raw security vulnerability and possible intrusion events that can be generated, even when a system is not under attack, it is important that these logic modules reside as close to the event sources as possible. This both reduces unnecessary network traffic caused by passing raw data to security management systems, and allows response modules to react in a more timely fashion.
Finally, there is a need to be able to correlate the volumes of data to filter certain events and messages so that security modules are not overwhelmed with information. Simple approaches that count events or reduce event redundancy are common. However, there is a need for a system that allows programmable logic modules to be introduced into a security system such that the modules can accurately reflect the context of security events.